AI Agent Sandboxes

Executive Summary

A new infrastructure category has emerged: sandbox platforms for AI agent code execution. These platforms solve the problem of "where should AI-generated code run?" with isolated, secure environments that agents can use to execute arbitrary code.

Market Leaders (10 platforms): E2B, Sprites, Daytona, Modal, Northflank, OpenSandbox, Quilt, Runloop, CodeSandbox SDK, ComputeSDK

Key Findings:

• E2B dominates with 200M+ sandboxes started and Fortune 100 adoption
• Sprites (Fly.io) challenges the ephemeral model with persistent VMs and instant checkpoint/restore
• Daytona offers the fastest creation (90ms) and unique Computer Use support
• Modal leads for GPU workloads with serverless Python infrastructure
• Northflank brings enterprise-grade VPC deployment with GPU support and flexible ephemeral/persistent modes
• OpenSandbox (Alibaba) introduces a protocol-driven open-source approach with multi-language SDKs and Kubernetes-native scaling
• The market is splitting into ephemeral (security-first) vs persistent (productivity-first) camps

Strategic Planning Assumptions:

• By 2027, checkpoint/restore will become table stakes across all platforms
• By 2028, Computer Use (browser/desktop) will be a standard feature, not a differentiator

---

Market Definition

AI agent sandboxes are isolated execution environments designed for running AI-generated or arbitrary code safely. They provide:

• Isolation — Code runs in VMs or containers, separated from host systems
• APIs/SDKs — Programmatic creation and management
• Security — Protection against malicious or buggy code
• Scalability — Ability to run thousands of concurrent sandboxes

Key distinction from cloud compute: These are purpose-built for agent use cases, not general application hosting. They optimize for fast creation, easy cleanup, and developer-friendly SDKs.

---

Comparison Matrix

Platform	Model	Creation	Persist	Checkpoints	GPU	Isolation
CodeSandbox	Persistent	~2s	✅	✅	—	microVMs
ComputeSDK	Abstraction	Varies	Varies	Varies	Varies	Varies
Daytona	Persistent	90ms	✅	—	—	Docker
E2B	Ephemeral	~150ms	—	—	—	Firecracker
Modal	Serverless	~2s	—	—	✅	gVisor
Northflank	Both	~1s	✅	—	✅	microVMs/gVisor
OpenSandbox	Ephemeral	~seconds	—	—	—	Docker/K8s
Quilt	Ephemeral	~200ms	—	—	—	Namespaces
Runloop	Persistent	~2s	✅	✅	—	Custom
Sprites	Persistent	1-2s	✅	✅	—	Firecracker
Vercel AI Gateway	API Proxy	N/A	N/A	N/A	—	N/A

Daytona also supports Computer Use (Linux/Windows/macOS virtual desktops). Vercel AI Gateway is an API proxy, not an execution sandbox — included for infrastructure completeness.

---

Product Profiles

E2B

The market leader for ephemeral AI sandboxes.^[1] Open-source, Firecracker VMs, used by 88% of Fortune 100.

• 200M+ sandboxes started, 1M+ monthly SDK downloads
• Firecracker microVMs (same tech as AWS Lambda)
• Custom templates for pre-configured environments
• Python, JavaScript, Go SDKs
• ⚠️ Ephemeral only — state destroyed after each session

Best for: Stateless code execution, security-sensitive workloads, high-volume eval pipelines.

Pricing: Free tier available. Usage-based billing.

---

Sprites

Persistent VMs with instant checkpoint/restore.^[2] Fly.io's answer to ephemeral sandbox limitations.

• 100GB persistent ext4 filesystem, backed by object storage
• Checkpoint/restore in ~1 second (like git for the whole system)
• Auto-sleep when idle, wake on demand — no charges when sleeping
• Firecracker VMs with hardware-level isolation
• ⚠️ New product, ecosystem still maturing

Best for: Agents that need state between runs, experimentation with checkpoint/rollback, long-running dev environments.

Pricing: $0.07/CPU-hour, $0.04375/GB-hour memory. ~$0.44 for 4-hour Claude Code session. $30 trial credits.^[2]

---

Daytona

Fastest creation (90ms) with Computer Use support.^[3] Open-source, supports Linux/Windows/macOS virtual desktops.

• Sub-90ms sandbox creation
• Computer Use sandboxes — control virtual desktops programmatically
• File, Git, LSP, and Execute APIs
• SSH access, VS Code browser, web terminal for debugging
• Open-source with self-hosting option
• ⚠️ Docker-based isolation (less secure than Firecracker)

Best for: Browser automation agents, Computer Use workloads, teams wanting open-source/self-hosted.

Pricing: Free tier. Usage-based for cloud.

---

Modal

Serverless Python with elastic GPU scaling.^[4] Built for ML/AI workloads, not just code execution.

• Sub-second cold starts, instant autoscaling
• GPU access (NVIDIA A100, H100) without quotas
• Define infrastructure in Python code (no YAML)
• Distributed filesystem for model loading
• ⚠️ Python-centric, less suitable for polyglot agents

Best for: GPU workloads, ML inference, training jobs, Python-native teams.

Pricing: $30/month free credits. Per-second billing for CPU, GPU, memory.

---

Northflank

Enterprise-grade microVMs with VPC deployment and GPU support.^[5] Running millions of sandboxes since 2021.

• Sub-second cold starts with microVM or gVisor isolation
• Deploy in their cloud OR your own VPC (AWS, GCP, Azure, Oracle)
• Ephemeral or persistent — you choose per workload
• GPU support (H100s at $2.74/hour, 62% cheaper than big clouds)
• Persistent volumes up to 64TB, S3-compatible storage
• Built-in CI/CD, autoscaling, and cost controls
• Trusted by Sentry and 50k+ developers
• ⚠️ More full-stack platform than pure sandbox; may be overkill for simple use cases

Best for: Enterprise teams needing VPC deployment, GPU workloads with strong isolation, or hybrid ephemeral/persistent requirements.

Pricing: CPU $0.01667/vCPU-hour, Memory $0.00833/GB-hour. GPUs from $0.80-$3.14/hour. Free sandbox tier available.^[6]

---

OpenSandbox

Open-source sandbox platform from Alibaba with a protocol-driven architecture.^[7] Multi-language SDKs and Docker/Kubernetes runtimes for local dev through production scale.

• Defines a "Sandbox Protocol" — standardized lifecycle + execution APIs
• Multi-language SDKs: Python, Java/Kotlin, JS/TS, C#/.NET (Go on roadmap)
• Docker runtime for local dev, high-performance Kubernetes runtime for distributed scheduling
• Built-in Command, Filesystem, and Code Interpreter implementations
• Network policy: unified ingress gateway with multiple routing strategies + per-sandbox egress controls
• Rich examples: Claude Code, Gemini CLI, Codex CLI, OpenClaw, Playwright, Chrome, VNC desktop, VS Code, RL training
• Apache 2.0 licensed, 2K+ GitHub stars
• ⚠️ Docker-based isolation (weaker than Firecracker); persistent storage still on roadmap

Best for: Teams wanting a self-hosted, protocol-driven sandbox platform with Kubernetes-native scaling and multi-language SDK support.

Pricing: Free (open source, self-hosted only).

---

Quilt

Open-source container infrastructure with inter-container communication.^[8] Self-hostable, built in Rust on Linux namespaces.

• ~200ms container creation
• Inter-container communication (ICC) for networking between containers
• Linux namespaces + cgroups isolation (lighter than Firecracker)
• TypeScript SDK for agent integration
• MIT/Apache-2.0 dual licensing, fully self-hostable
• ⚠️ Weaker isolation than Firecracker; early-stage product

Best for: Multi-container agent architectures, self-hosting, teams needing container networking.

Pricing: Open-source (self-hosted). Cloud offering in development.

---

Runloop

Devboxes with git-style state management.^[9] Snapshot and branch from disk state.

• 2x faster vCPUs on custom bare-metal hypervisor
• 100ms command execution
• Snapshot and branch disk state (like git for sandboxes)
• Built-in SWE-bench integration for agent evaluation
• Repo connections with automatic environment inference
• ⚠️ Focused on agent benchmarking, less general-purpose

Best for: Agent development, SWE-bench evals, teams needing reproducible environments.

Pricing: Contact for pricing. Free trial available.

---

CodeSandbox SDK

Sandbox API with forking and snapshots.^[10] From the popular browser IDE company (now owned by Together AI).

• Programmatic sandbox creation via SDK
• Forking mechanism for A/B testing agents
• Snapshots and hibernation
• Resume development after inactivity
• ⚠️ Acquired by Together AI; product direction may shift

Best for: Teams already using CodeSandbox, web development agents, educational platforms.

Pricing: Free tier. Usage-based for scale.

---

ComputeSDK

Unified abstraction layer for sandbox providers.^[11] Write once, run on E2B, Daytona, Modal, Vercel, or CodeSandbox.

• Hot-swappable providers — change via config, not code rewrites
• Supports E2B, Daytona, Modal, Vercel, CodeSandbox
• Free and open source (TypeScript)
• "Terraform for running other people's code"
• ⚠️ Early stage (94 GitHub stars); abstraction may hide provider-specific features

Best for: Teams wanting multi-provider flexibility or avoiding vendor lock-in.

Pricing: Free (open source). You pay underlying providers directly.

---

Vercel AI Gateway

Unified API proxy for 100s of AI models with budget controls and fallbacks.

• Single API key accesses OpenAI, Anthropic, Google, xAI, and more
• No markup on tokens — provider list prices
• Automatic retries and fallbacks across providers
• Built-in observability (traces, spend, latency)
• BYOK (Bring Your Own Key) support
• Sub-20ms routing latency

Best for: Teams using Vercel who want unified multi-provider access without managing infrastructure.

Pricing: $5/month free credit. Provider list prices for tokens (no markup).

Note: Vercel AI Gateway is an API proxy, not an execution sandbox. Included here as agent infrastructure.

---

Architecture Patterns

Isolation Technologies

Technology	Used By	Security Level	Performance
Firecracker	E2B, Sprites	⭐⭐⭐ Hardware-level	Fast
gVisor	Modal, Northflank	⭐⭐ Kernel-level	Very Fast
Docker/K8s	Daytona, OpenSandbox	⭐ Container-level	Fastest
Namespaces	Quilt	⭐ Kernel-level	Very Fast
Custom Hypervisor	Runloop	⭐⭐⭐ Hardware-level	Fast
microVMs	CodeSandbox, Northflank	⭐⭐⭐ Hardware-level	Fast

Firecracker (used by E2B, Sprites) provides the strongest isolation — the same technology AWS uses for Lambda. Each sandbox is a true microVM with its own kernel.

Ephemeral vs Persistent

The market is splitting into two philosophical camps:^[12]

Ephemeral (E2B model):

• Fresh environment every time
• Maximum security (no state leakage)
• Simpler mental model
• Must rebuild environment each session

Persistent (Sprites model):

• State survives between runs
• No rebuilding node_modules/packages
• Checkpoint/restore for experimentation
• Risk of state pollution

Fly.io argues that "ephemeral sandboxes are obsolete" for AI agents — Claude doesn't want a stateless container, it wants a computer.^[12] E2B would counter that ephemerality is a feature, not a bug, for security-sensitive enterprise deployments.

---

Enterprise Feature Comparison

Feature	CodeSandbox	ComputeSDK	Daytona	E2B	Modal	Northflank	OpenSandbox	Quilt	Runloop	Sprites
SOC2	✅	—	✅	✅	✅	✅	—	—	❓	✅ (Fly.io)
Self-hosting	—	—	✅	✅	—	✅ (VPC)	✅	✅	❓	—
Open source	—	✅	✅	✅	—	—	✅	✅	—	—
Custom templates	✅	—	✅	✅	✅	✅	✅	—	✅	—
Team features	✅	—	✅	✅	✅	✅	—	—	✅	—
GPU	—	Varies	—	—	✅	✅	—	—	—	—
Computer Use	—	Varies	✅	—	—	—	✅ (VNC)	—	—	—
Container networking	—	—	—	—	—	✅	✅ (Ingress)	✅	—	—

---

Strategic Recommendations

By Use Case

Use Case	Recommended	Runner-Up
High-security enterprise	E2B	Northflank (VPC)
Persistent agent state	Sprites	CodeSandbox
GPU/ML workloads	Modal	Northflank
Browser automation	Daytona	—
Agent benchmarking (SWE-bench)	Runloop	E2B
Fastest creation time	Daytona	E2B
Checkpoint/restore	Sprites	Runloop
Open source preference	E2B	OpenSandbox
Cost optimization (idle)	Sprites	Modal
Inter-container networking	Quilt	Northflank
VPC/BYOC deployment	Northflank	Daytona (self-hosted)
Multi-provider flexibility	ComputeSDK	—

By Team Profile

Security-first enterprise team: → E2B (ephemeral, Firecracker, SOC2) or Northflank (VPC deployment)

AI agent startup iterating fast: → Sprites (persistence saves rebuild time, checkpoints for experimentation)

ML/AI team needing GPUs: → Modal (serverless Python) or Northflank (VPC + full infrastructure)

Building Computer Use agents: → Daytona (only option with desktop automation)

Self-hosted Kubernetes-native team: → OpenSandbox (protocol-driven, multi-language SDKs, K8s scheduling)

Running agent evaluations: → Runloop (built-in SWE-bench) or E2B (scale)

Enterprise needing VPC/BYOC: → Northflank (AWS, GCP, Azure, Oracle support with full platform)

---

Market Outlook

Near-Term (2026)

• Checkpoint/restore spreading beyond Sprites/Runloop
• E2B maintaining market share lead on ephemeral
• Daytona growing in Computer Use segment

Medium-Term (2027)

• Persistent vs ephemeral distinction blurring (both become options)
• Computer Use becoming standard feature
• GPU support expanding — Northflank already challenging Modal's monopoly

Long-Term (2028+)

• Category may consolidate around 2-3 leaders
• Integration with agent orchestration platforms (Tembo, etc.)
• Specialized sandboxes for specific agent types

---

Bottom Line

10 platforms serve the AI agent sandbox market with distinct approaches:

Platform	Best For	Key Differentiator
CodeSandbox	Web dev agents	Forking, established ecosystem
ComputeSDK	Multi-provider flexibility	Unified API across E2B/Daytona/Modal/etc.
Daytona	Computer Use and speed	90ms creation, Linux/Win/macOS desktops
E2B	Ephemeral execution at scale	200M+ sandboxes, Fortune 100 adoption
Modal	GPU workloads	Elastic GPU scaling, Python-native
Northflank	Enterprise VPC + GPUs	BYOC deployment, microVM/gVisor isolation
OpenSandbox	Self-hosted K8s-scale	Protocol-driven, multi-language SDKs, Alibaba-backed
Quilt	Multi-container agents	Open-source, inter-container networking
Runloop	Agent development/evals	SWE-bench integration, disk snapshots
Sprites	Persistent state with checkpoints	Object-storage durability, instant restore

The market is early and growing fast. E2B has the adoption lead, but Sprites and Daytona are pushing the boundaries on what sandboxes can do. Modal leads GPU workloads but Northflank is challenging with cheaper H100s and VPC deployment. Alibaba's OpenSandbox brings a credible open-source, protocol-driven alternative for teams wanting full control over their sandbox infrastructure at Kubernetes scale. The winners will be determined by which model — ephemeral or persistent — proves better for production AI agents, and whether enterprises prefer pure sandboxes or full-stack platforms.

---

Research by Ry Walker Research

Disclosure: Author is CEO of Tembo, which may integrate with sandbox platforms for agent execution.